Which search string only returns events from hostWWW3?

The correct answer is B. host=WWW3. Option B (host=WWW3) is correct because it performs an exact, case-sensitive field match, returning only events where the host field equals precisely "WWW3" - no more, no less. *A (host=)* is wrong because the wildcard ` matches any value, so it returns events from all hosts…

Question

Options

Ahost=*
Bhost=WWW3
Chost=WWW*
DHost=WWW3

How the community answered

(25 responses)

A
8% (2)
B
72% (18)
C
4% (1)
D
16% (4)

Explanation

Option B (host=WWW3) is correct because it performs an exact, case-sensitive field match, returning only events where the host field equals precisely "WWW3" - no more, no less.

A (host=*) is wrong because the wildcard * matches any value, so it returns events from all hosts, not just WWW3.
C (`host=WWW)* is wrong because the trailing wildcard matches any host starting with "WWW" (e.g., WWW1, WWW2, WWW3, WWW4), returning far more than just WWW3.
D (Host=WWW3) is wrong because Splunk field names are case-sensitive - Host (capital H) is not the same as the default indexed field host (lowercase), so this search would return no results or unexpected results.

Memory tip: Think of the equals sign as a promise - host=WWW3 promises an exact match. Any wildcard (*) breaks that promise by allowing other values in, and a capital letter breaks the field name itself.

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice